Login Request a demo
CR
Vendor
Craftcms
5 products with CVEs on record
199
CVEs
7
On KEV
17
New 30D
Products
CM
cms
craftcms
10.0
80 CVEs3 on KEV16 new
CO
commerce-mollie
craftcms
7.5
1 CVEs0 on KEV1 new
CC
Craft Cms
Craftcms
10.0
97 CVEs4 on KEV0 new
CC
Craft Commerce
Craftcms
8.8
17 CVEs0 on KEV0 new
CO
commerce
craftcms
8.7
4 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-115938
New
CM
cms
craftcms
8.8
0%
Oct 23Low privilege condition filter escapes Twig sandbox, recovers "securityKey" and reaches RCE
CVE-2026-115937
New
CO
commerce-mollie
craftcms
7.5
0%
Oct 23Unauthenticated payment reuse allows unpaid orders to be marked as paid
CVE-2026-115935
New
CM
cms
craftcms
8.8
0%
Oct 23Control panel only API response emulation replaces "securityKey" and reaches server RCE
CVE-2026-112777
CM
cms
craftcms
7.2
1%
Oct 19Craft CMS before 4.18.8 and 5.11.0 Twig create() Blocklist Bypass Leading to RCE
CVE-2026-112776
CM
cms
craftcms
9.8
0%
Oct 19Craft CMS 5.0.0 before 5.11.0 GraphQL Site-Scope Bypass via Mutations
CVE-2026-112775
CM
cms
craftcms
7.5
0%
Oct 19Craft CMS 5.0.0 before 5.11.0 Verification Code Reuse via users/set-password
CVE-2026-112774
CM
cms
craftcms
7.2
1%
Oct 19Craft CMS 5.8.0 before 5.11.0 Admin RCE via ContentBlock Field Layout
CVE-2026-112773
CM
cms
craftcms
8.8
1%
Oct 19Craft CMS 5.0.0 before 5.11.0 RCE via Twig Sandbox Behavior Injection
CVE-2026-112772
CM
cms
craftcms
8.8
1%
Oct 19Craft CMS 5.0.0 before 5.11.0 RCE via Asset::getMimeType Transform Injection
CVE-2026-112771
CM
cms
craftcms
6.5
0%
Oct 19Craft CMS before 4.18.8 and 5.11.0 Twig Sandbox Allowlist Bypass via Array Filters
CVE-2026-112770
CM
cms
craftcms
8.8
1%
Oct 19Craft CMS before 4.18.8 and 5.11.0 Authenticated RCE via Twig group Filter Array-Callable
CVE-2026-109308
CM
cms
craftcms
8.8
0%
Oct 12Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 RCE via actionCacheUpdates Behavior Injection
CVE-2026-109307
CM
cms
craftcms
4.7
0%
Oct 12Craft CMS 5.0.0 before 5.10.14 DOM XSS via returnUrl in 2FA Verification
CVE-2026-109306
CM
cms
craftcms
5.9
0%
Oct 12Craft CMS 5.0.0 before 5.10.14 Missing Authorization via app/switch-to-licensed-edition
CVE-2026-109305
CM
cms
craftcms
8.8
0%
Oct 12Craft CMS 5.10.2 before 5.10.14 Twig Sandbox Bypass RCE via has some/has every
CVE-2026-109304
CM
cms
craftcms
4.9
0%
Oct 12Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 Arbitrary File Read via Twig create() DOMDocument
CVE-2026-105985
CM
cms
craftcms
8.8
1%
Oct 6Authenticated RCE via render-components Entry Type overrides
CVE-2026-92594
CM
cms
craftcms
7.5
0%
Sep 16Craft CMS before 5.11.0 Unauthenticated PII Disclosure via GraphQL
CVE-2026-92593
CM
cms
craftcms
8.8
1%
Sep 16Craft CMS 5.10.0 before 5.10.13 Authenticated Remote Code Execution
CVE-2026-92592
CM
cms
craftcms
8.8
1%
Sep 16Craft CMS before 4.18.6 Remote Code Execution via signed cookie
CVE-2026-92591
CM
cms
craftcms
5.9
0%
Sep 16Craft CMS 5.0.0 before 5.10.13 Environment Secret Exposure via Installer
CVE-2026-92590
CM
cms
craftcms
5.4
0%
Sep 16Craft CMS 5.7.0 before 5.10.13 Stored XSS via Generated Fields
CVE-2026-92589
CM
cms
craftcms
4.3
0%
Sep 16Craft CMS 5.0.0 before 5.10.13 Broken Access Control via nested-elements/reorder
CVE-2026-55795
CO
commerce
craftcms
6.9
1%
Sep 14Craft Commerce: Coupon Code Brute-Force via Rate Limit Bypass
CVE-2026-79987
CM
cms
craftcms
8.8
1%
Sep 10Low-privilege RCE through element-search eager loading
CVE-2026-86732
CM
cms
craftcms
8.8
1%
Sep 8Craft CMS before 5.10.12 Remote Code Execution via element-index
CVE-2026-86731
CM
cms
craftcms
6.5
0%
Sep 8Craft CMS 5.0.0-RC1 before 5.10.12 Permission Escalation via UsersController
CVE-2026-86730
CM
cms
craftcms
8.8
1%
Sep 8Craft CMS 5.0.0-RC1 before 5.10.12 Behavior Injection RCE
CVE-2026-79991
CM
cms
craftcms
7.1
1%
Sep 2Authenticated SQL Injection via nested eager-loading criteria
CVE-2026-79990
CM
cms
craftcms
8.7
0%
Sep 2GQL entry mutation `siteId` bypasses schema site scope, enabling cross-site content read/write/delete
CVE-2026-79989
CM
cms
craftcms
8.7
0%
Sep 2Arbitrary user password reset leading to administrator account takeover
CVE-2026-84802
CM
cms
craftcms
4.3
0%
Sep 2Craft CMS 5.7.0 before 5.10.12 Information Disclosure via AssetsController
CVE-2026-84801
CM
cms
craftcms
8.8
0%
Sep 2Craft CMS 5.0.0-RC1 before 5.10.11 Authentication Bypass via administrateUsers
CVE-2026-84800
CM
cms
craftcms
7.1
0%
Sep 2Craft CMS 5.0.0-RC1 before 5.10.11 File Overwrite via assets/replace-file
CVE-2026-84799
CM
cms
craftcms
4.3
0%
Sep 2Craft CMS before 5.11.0 PII Disclosure via GraphQL User Relations
CVE-2026-84798
CM
cms
craftcms
7.1
0%
Sep 2Craft CMS before 5.10.11 Authorization Bypass via actionDeleteForSite
CVE-2026-84797
CM
cms
craftcms
6.3
0%
Sep 2Craft CMS 5.0.0-RC1 before 5.10.11 Authorization Bypass via actionDuplicate
CVE-2026-84796
CM
cms
craftcms
8.8
0%
Sep 2Craft CMS 5.0.0-RC1 before 5.10.11 GraphQL Entry Mutation Site Scope Bypass
CVE-2026-84795
CM
cms
craftcms
9.8
1%
Sep 2Craft CMS before 5.10.11 Authentication Bypass via Admin Flag Inheritance
CVE-2026-84794
CM
cms
craftcms
7.1
0%
Sep 2Craft CMS 5.0.0 through 5.10.10 Authorization Bypass via assets/move-asset
CVE-2026-84793
CM
cms
craftcms
4.8
0%
Sep 2Craft CMS 5.0.0-RC1 before 5.10.11 Stored XSS via site name
CVE-2026-84792
CM
cms
craftcms
4.3
0%
Sep 2Craft CMS before 5.10.11 Broken Access Control via element-indexes
CVE-2026-79988
CM
cms
craftcms
8.7
0%
Aug 27Authenticated RCE through Twig sandbox escape
CVE-2026-78416
CM
cms
craftcms
8.7
1%
Aug 24Authenticated RCE via `condition.config` JSON cleanse bypass
CVE-2026-72787
CM
cms
craftcms
6.4
0%
Aug 12Craft CMS 5.0.0-RC1 before 5.10.8 Stored XSS via Draft Name
CVE-2026-72786
CM
cms
craftcms
6.5
0%
Aug 12Craft CMS 5.0.0-RC1 before 5.10.8 Authentication Bypass via Password Reset
CVE-2026-72785
CM
cms
craftcms
4.3
0%
Aug 11Craft CMS before 5.10.6 Authorization Bypass via structures/move-element
CVE-2026-72784
CM
cms
craftcms
5.4
0%
Aug 11Craft CMS 5.0.0-RC1 before 5.10.6 SSRF via GraphQL asset mutation
CVE-2026-72783
CM
cms
craftcms
6.2
0%
Aug 11Craft CMS 5.0.0-RC1 before 5.10.6 Path Traversal via ensurePathIsContained
CVE-2026-72782
CM
cms
craftcms
6.5
0%
Aug 11Craft CMS 5.0.0-RC1 before 5.10.6 Environment Variable Leak
CVE-2026-72781
CM
cms
craftcms
8.8
1%
Aug 11Craft CMS 5.0.0-RC1 before 5.10.7 Remote Code Execution via Twig Sandbox Escape
CVE-2026-72780
CM
cms
craftcms
6.5
0%
Aug 11Craft CMS before 5.10.5 WebAuthn Assertion Replay via login-with-passkey
CVE-2026-72779
CM
cms
craftcms
4.5
0%
Aug 11Craft CMS 5.0.0-RC1 before 5.10.6 Arbitrary File Read via SplFileObject
CVE-2026-72778
CM
cms
craftcms
8.8
1%
Aug 11Craft CMS 5.0.0-RC1 before 5.10.6 Authenticated RCE via condition.config
CVE-2026-50282
CM
cms
craftcms
4.9
0%
Jul 2Craft CMS: Unauthorized Deletion of Destination Folders During Forced Moves
CVE-2026-50281
CM
cms
craftcms
7.1
0%
Jul 2Craft CMS: Mass assignment via id in newAttributes during bulk duplicate overwrites existing elements
CVE-2026-50280
CM
cms
craftcms
6.0
0%
Jul 1Craft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save check
CVE-2026-50279
CM
cms
craftcms
7.6
0%
Jul 1Craft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gap
CVE-2026-55794
CM
cms
craftcms
8.7
0%
Jul 1Craft CMS: Potential authenticated Remote Code Execution via referrer redirect
CVE-2026-55792
CM
cms
craftcms
6.0
0%
Jul 1Craft CMS: Sensitive File Disclosure / Server-Side File Read